Re: Sensitive Information Disclosure Vulnerability in Kinetics Kiosk Product

["Zow" Terry Brugger <zow () llnl gov>]

>       Especially considering that the IP address is within a Wells Fargo 
> Bank class B netblock.  It just gets curiouser and curiouser.

No, that actually explains a lot -- you know how you swipe your credit card 
at the kiosk so that it can retrieve your flight information? Well, it needs 
to map your CC number to a name, and whether your name is encoded on the mag 
stripe or not, it should go back to a bank to retrieve that information. I 
bet you one good cup of coffee (offer applies to Jason and Jay only) that 
that's why they're connecting to Wells Fargo.

Now then, one could debate the wisdom of transferring this information in the 
clear (http as opposed to https). I'm not going to try to connect to the 
server myself out of politeness, but I would hope that the connection is 
being tunneled through the Internet by a VPN, and that the server is 
otherwise inaccessible. If that is the case, I think the debate over whether 
it uses a public or private IP is academic.

The potential insecurities in the use of Win/IE for a public kiosk are worth 
considering, however I'm personally more concerned when my pilot tells us 
that we're going to be delayed from pushing back for a minute because they 
need to do the equivalent of a Control-Alt-Delete to the plane.

Cheers,
Terry

import StandardDisclaimer;